diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da4813c4d..d3ade00b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Configure git to use HTTPS for GitHub
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
@@ -52,7 +52,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Configure git to use HTTPS for GitHub
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
@@ -98,7 +98,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Configure git to use HTTPS for GitHub
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Configure git to use HTTPS for GitHub
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index aa305a3b1..55cfc1af3 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -83,7 +83,7 @@ jobs:
       lanes: ${{ steps.gen.outputs.lanes }}
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up E2E environment
       uses: ./.github/actions/setup-e2e
@@ -211,7 +211,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up E2E environment
       uses: ./.github/actions/setup-e2e
@@ -298,7 +298,7 @@ jobs:
         shell: bash
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up E2E environment
       uses: ./.github/actions/setup-e2e
diff --git a/.github/workflows/kit-image-rebuild.yml b/.github/workflows/kit-image-rebuild.yml
index 3943b2582..99cdc3fcc 100644
--- a/.github/workflows/kit-image-rebuild.yml
+++ b/.github/workflows/kit-image-rebuild.yml
@@ -63,7 +63,7 @@ jobs:
       cve_count: ${{ steps.findings.outputs.count }}
     steps:
       - name: Check out main
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         # main (the single trunk a scheduled run checks out) carries the
         # release manifest — which version is actually released. The pinning
         # ledger is read from main below (where this workflow's bump PRs land),
@@ -289,7 +289,7 @@ jobs:
       # Cut from and PR against the trunk (main). This is also what the decide
       # job's ledger comparison reads, so merging the PR quiesces the trigger.
       - name: Checkout main
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           ref: main
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/kit-publish.yml b/.github/workflows/kit-publish.yml
index 0ebdcfb15..6b8efda06 100644
--- a/.github/workflows/kit-publish.yml
+++ b/.github/workflows/kit-publish.yml
@@ -72,7 +72,7 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
       - name: Checkout the release ref
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           ref: ${{ inputs.ref }}
 
@@ -160,7 +160,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout the release ref
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           ref: ${{ inputs.ref }}
 
@@ -233,7 +233,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout the release ref
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           ref: ${{ inputs.ref }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 14126bf76..c6b255317 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           fetch-depth: 0
 
@@ -53,7 +53,7 @@ jobs:
     environment: release
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           fetch-depth: 0
 
@@ -125,7 +125,7 @@ jobs:
           repositories: add-band
 
       - name: Checkout add-band
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           repository: band-ai/add-band
           token: ${{ steps.app-token.outputs.token }}